7388b8f211d0e8e7edcc148a5d80b0ff756a210fde85d9b110ac70e008c768fd

Analysis

max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_7388b8f211d0e8e7edcc148a5d80b0ff756a210fde85d9b110ac70e008c768fd.dll
Size 17KB
Sample260924-ehtq4sde67
SHA256 7388b8f211d0e8e7edcc148a5d80b0ff756a210fde85d9b110ac70e008c768fd
MD5 47e30295ebb40f558a12eedb573f3d4d
SHA1 4bdb831868056f09cd2ad79d593067ba3ae9858f
SHA512 894390713b57e51ea2a16014719a6ce21a6dc687e38e1f184a4b23b2797a3ddf6505c7c0226074e3cfd5b4dcac6f1881d0acbc7c045b2c69a79751ba3af8d18a
SSDEEP 96:JpoTovg8JFI7KzEIpkH2/f3X3X3frPf3cFZUmsIW3TqIiAc1JgiPBX:J6ovgYysXnTUFZtsIeTqpA4BX
TLSH
T1D9722A236A587CE3C2210E38318A0BA3983C527407A46567D7F14E9D2EBC19BCB35F42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

adware discovery stealer

Malware Config

Signatures

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C5BF49A2-94F3-42BD-F434-3604812C8955}	regsvr32.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C8955}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C8955}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_7388b8f211d0e8e7edcc148a5d80b0ff756a210fde85d9b110ac70e008c768fd.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C8955}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C8955}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C8955}\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_7388b8f211d0e8e7edcc148a5d80b0ff756a210fde85d9b110ac70e008c768fd.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C8955}\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3832	regsvr32.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3832	4452	regsvr32.exe	87

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7388b8f211d0e8e7edcc148a5d80b0ff756a210fde85d9b110ac70e008c768fd.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\jaffacakes118_7388b8f211d0e8e7edcc148a5d80b0ff756a210fde85d9b110ac70e008c768fd.dll
  2⤵
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads